GHSA-9m63-33q3-xq5x

Source

https://github.com/advisories/GHSA-9m63-33q3-xq5x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-9m63-33q3-xq5x/GHSA-9m63-33q3-xq5x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9m63-33q3-xq5x

Aliases

Published

2025-03-10T22:24:35Z

Modified

2025-03-14T20:02:47Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Vela Server Has Insufficient Webhook Payload Data Verification

Details

Impact

Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit.

Any user with access to the CI instance and the linked source control manager can perform the exploit.

Method

By spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository.

These secrets could be exfiltrated by follow up builds to the repository.

Patches

v0.26.3 — Image: target/vela-server:v0.26.3 v0.25.3 — Image: target/vela-server:v0.25.3

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There are no workarounds to the issue.

References

Are there any links users can visit to find out more?

Please see linked CWEs (common weakness enumerators) for more information.

Database specific

{
    "nvd_published_at": "2025-03-10T19:15:41Z",
    "cwe_ids": [
        "CWE-290",
        "CWE-345"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T22:24:35Z"
}

References

Affected packages

Go / github.com/go-vela/server

Package

Name: github.com/go-vela/server; View open source insights on deps.dev
Purl: pkg:golang/github.com/go-vela/server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.25.3

Go / github.com/go-vela/server

Package

Name: github.com/go-vela/server; View open source insights on deps.dev
Purl: pkg:golang/github.com/go-vela/server

Affected ranges

Type: SEMVER
Events: Introduced

0.26.0

Fixed

0.26.3

Database specific

{
    "last_known_affected_version_range": "<= 0.26.2"
}